Attachment_J-5_IDES_Access_and_PKIIA_Awareness_Attributes.pdf

IDES Access and PKI/IA Awareness Attributes, Attachment J-5

DISTRIBUTION STATEMENT A: Approved for public release. Distribution unlimited.

Common Hull Auxiliary Multi-Mission Platform

(CHAMP)

Integrated Digital Environment Site Access and

Public Key Infrastructure/Information Assurance Awareness Attributes

Attachment J-5

17 December 2018

Prepared by Naval Sea Systems Command

1333 Isaac Hull Ave. SE Washington Navy Yard, DC 20376-2101

1.0 Integrated Digital Environment Site Access

The Contractor will provide data products to the Government via the Integrated Digital Environment Site (IDES).

1.1 Requesting an IDES Account

A. All IDES users must have a Public Key Infrastructure (PKI) certificate, and have completed annual Information Assurance (IA) Awareness Training and System Authorization Access Request Navy (SAAR_N) documentation before access will be granted.

B. The IA certificate and SAAR_N form will be uploaded to the IDES by the new user during the process to establish the account.

C. Contact IDES staff at the Program Management System-Extranet Site (PMS-ES) Help Desk at 1-800-292-7178 to identify the project New Account Sponsor who will be initiating your account; then, D. Contact the project New Account Sponsor via email providing the required data to initialize your account, including:

a. First Name

b. Middle Initial

c. Last Name

d. Email Address

e. Organization (e.g. company name)

f. Organization Code (if applicable)

Note: the above information must match the information on an existing PKI certificate, or the information used to establish a PKI certificate.

2.0 Department of Defense Public Key Infrastructure External Certificate Authority Certificate Process

For users without a Department of Defense (DoD) PKI External Certificate Authority (ECA) Certificate, the following guidance is provided to help explain the certificate ordering process.

This guidance is not intended to substitute for the procedures established by the individual ECA activities who administer PKI ECA Certificates for DoD.

2.1 Purchasing an External Certificate Authority Certificate

To purchase an ECA Certificate, a person must be one of the following:

Employee of an organization conducting business with a United States (U.S.) government agency.

Employee of a state or local government conducting business with another U.S.

government agency.

Employee of a foreign government or organization conducting business with a U.S.

government agency.

Individual who needs to communicate securely with a U.S. government agency.

2.2 Certificate Ordering Process

The certificate ordering process is comprised of three steps: Online Application, Identity Verification, and Secure Online Certificate Delivery. During all three steps, users will need to work with the Local Registration Authority (LRA) who may also be referred to as a Trusted Agent (TA), and is an employee of the user’s organization who manages ECA Certificate enrollments.

2.2.1 Online Application

Each certificate requester must perform the online application by accessing one of three ECA websites and complying with their application requirements for certificate ordering. The type of PKI certificate (soft [electronic] or hard card) is an important consideration since it concerns portability of the certificate from one personal computer to another.

Note: A user must use the same work station for the online application process and when retrieving the certificate.

2.2.2 Identity Verification for Citizens of the United States, Great Britain, Canada, Australia, and New Zealand

Citizens of the U.S., Great Britain, Canada, Australia, and New Zealand will need to present the following to a Notary Public (if a user is being processed outside the U.S., see a U.S. Consular Notary), or an authorized LRA/TA:

a. Request form generated during the online application process containing the user’s request Identification (ID).

b. Two forms of photo identification:

One must be a valid, current, official government ID such as a passport, driver's license, or government-issued photo identity card or badge.

The second can be a photo identity card or badge officially issued by a company or institution.

Note: A Proof of Organizational Affiliation letter does NOT replace one of the required photo IDs.

c. Proof of Nationality

Non-U.S. Citizens must submit a photocopy of a passport from their country of Citizenship (or Nationality).

U.S. citizens may submit a photocopy of either: passport, birth certificate, Certificate of Naturalization, Certificate of Citizenship, FS-240 Consular Report of Birth Abroad, or DS-1350 Certification of Report of Birth.

d. Form of Payment (Purchase Order Number, Check, Credit Card)

e. Proof of Organizational Affiliation

If a company issued ID was submitted as one of two forms of photo identification, it will also work as Proof of Organizational Affiliation

If a user is not submitting a copy of a company issued ID, they will need to submit a letter on company letterhead signed by a Duly Authorized Company Representative stating that they are an employee of that organization

Note: Citizens of other countries are subject to separate processing procedures for identity verification. Contact the IDES staff at the PMS-ES Help Desk at 1-800-292-7178 for assistance.

2.2.3 Secure Online Certificate Delivery

The applicant will receive a Certificate Issuance Notification email. The email will explain how to import, test, and backup the certificate depending on whether the user is procuring a soft certificate (electronic) or hard card PKI ECA certificate. A user must use the same work station for the online application process and when retrieving the certificate.

2.3 External Certificate Authorities in the United States

There are three ECAs in the U.S.

a. Operations Research Consultants (ORC), Inc. in Fairfax, VA, http://www.orc.com

Help Desk online 24/7 (ecahelp@orc.com) or an ORC Service Rep 0730-1930 (Eastern Time) 1-800-816-5546.

b. Identity Trust in Salt Lake City, UT, http://www.idenTrust.com

Help Desk online 0100-1800 (Mountain Time (MT)) (helpdesk@identrust.com) or an IdenTrust Service Rep 1800-0100 (MT), U.S. 1-888-882-1104.

c. VeriSign, Inc. in Mountain View, CA, http://www.verisign.com, Phone: 1-866-202-5570 or 650-426-3896 (local).

Help Desk: Installation Questions: eca-support@verisign.com Enrollment Questions: eca-authentication@verisign.com

3.0 Annual Information Assurance Awareness Training and System Authorization Access Request Navy

In addition to acquiring a PKI certificate, users are required to complete annual IA Awareness Training and a SAAR_N form.

Upon entering the New User Invitation page, the user can access the links for the IA Awareness Training and SAAR_N form through the Training and documentation link. For additional information, see:

Appendix A: Information Assurance Awareness Training Guidance

Appendix B: System Authorization Access Request Navy (SAAR_N) Instructions

Users who have already taken the annual IA Awareness Training within 12 months of this account request can upload their IA Awareness Certificate of completion to their IDES once they receive their new account invitation.

Once the IDES account request has been approved, users will receive an email from “PMS-ESnotifier@navy.mil” indicating that the account has been created. Once notification is received that the account has been created, use Internet Explorer to navigate to https://pmses.navy.mil to access the IDES.

Should you have problems with access, contact the IDES staff at the PMS-ES Help Desk at 1-800-292-7178.

Information Assurance (IA) Training (Cyber Awareness Challenge)

This course is available on the Information Assurance Support Environment (IASE) and Navy Knowledge Online (NKO) websites. NKO requires a Common Access Card (CAC). IASE does not.

Before beginning, check IASE’s troubleshooting guide to ensure that your browser is configured correctly so you’ll be able to print the certificate when you’ve completed the training:

http://iase.disa.mil/eta/troubleshoot-guide.html

The training link is http://iase.disa.mil/eta/ for Cyber Awareness Challenge for Federal, Department of Defense (DoD), and Intelligence Community Employees. Course catalog title is DOD Cyber Awareness Challenge V2. Course number is DOD-IAA-V12.0 34.

As soon as you complete the training, you should see the following screen. Type your name in the field and click Print Certificate. Do not close this window until you’ve printed your certificate.

You can print the certificate to Adobe PDF (or other PDF writer) and sign it using your CAC/PKI, or print a hard copy, sign it and scan it. The certificate must be signed. The PDF can then be uploaded to the IDES under ‘My Account.’ See the SAAR-N help document (Appendix B) for help with that.

If you completed the training on IASE, but didn’t get a certificate: Before starting over, try using the ‘Continue Current’ vs ‘Launch New’ link. If it shows all your trophies and score, you should be able to retake one task to get the above screen again.

Please contact the IDES staff at the PMS-ES Help Desk at 1-800-292-7178 for assistance.

Appendix B: SAAR_N Instructions

Block-by-Block help with the SAAR_N

Block Form Field Selection or Instructions Type of Request Initial Date Current date. Click in the field and a calendar will open.

System Name PMS-ES (copy/paste) Location DISA DECC Mechanicsburg PA (copy/paste) PART I (to be completed by requester)

1. Name Fill out your Last, First, Middle Initial

2. Organization Your company or activity

3. Office Symbol/Department Enter your code or leave blank if none. On the IDES, you can click ‘My Account’ to see how your Organization and Department are currently identified (as Activity and Org/Code).

4. Phone Enter your commercial (work) number.

If you’re seated in a government bldg you might also have a Defense Switched Network (DSN) number, or you can leave it blank.

5. Official E-Mail Address The e-mail address used for your CAC/PKI certificate. It’s shown in your IDES ‘My Account’ screen. Don’t change it in ‘My Account,’ by the way, or you won’t be able to log into the IDES.

6. Job Title and Grade/Rank Contractors can just enter their job title

7. Official Mailing Address Work address

8. Citizenship US, Foreign National, Local National, or Other (specify)

9. Designation of Person Pick one

10. IA Training Requirements Check the box and enter the completion date from your certificate. If you haven’t completed the training, see the IA help file.

PART II – Endorsement of access by information owner, user supervisor or government sponsor

11. Justification for Access State the reason you require access to PMS-ES files, or enter the following: Access to PMS-ES is required to satisfy project work assignments for the PMS (Program Offices) ship design program.

12. Type of Access Required Authorized 12a. Date Signed Leave blank

13. User Requires Access To Unclassified

14. Verification of Need to Know Check the box. This is your supervisor (Block 16) certifying that you need access to the PMS-ES IDES.

14a. Access Expiration Date Government personnel leave this field blank.

Subcontractors should include their own company name and the prime contractor’s company name, the contract number and expiration date (e.g., ICI Services (CSC subcontractor), XXXXXXXXXX-

XXXX, 9/1/2015).

15- 16b.

Supervisor info and signature

Signature should be digital, using a CAC/PKI, if possible, to avoid filling out a hard copy form by hand.

Blocks 15-16b to be completed by your company supervisor.

WARNING: After signing Block 16a, Blocks 11-16b can no longer be edited, so ensure they are filled out completely.

17- 17b.

Information Owner/OPR Info and Signature

Leave blank

Appendix B: SAAR_N Instructions

Block Form Field Selection or Instructions 18- 21.

IAM or Appointee Info and Signature

22. User Agreement The list of provisions you are agreeing to by submitting this form.

23. Name Your name, same as Block 1.

24. User Signature

Signature should be digital, using a CAC/PKI, if possible, to avoid filling out a hard copy form by hand.

WARNING: After signing Block 24, Blocks 1-10 can no longer be edited, so ensure they are filled out completely.

Insert your CAC/PKI and click in the field to sign.

If you can’t sign digitally, send the form to your security officer to fill out Part III next, then print and sign/date when you get it back.

25. Date Signed Automatically fills in if you sign digitally PART III – Security Manager Validates the Background Investigation or Clearance

Information 26- 30.

Security Clearance info and Security Manager signature

To be filled out by your department or company security officer, or whoever would normally submit a Visit Authorization Request (VAR) for you through Joint Personnel Adjudication System (JPAS). The IDES help desk does not have access to your JPAS information and they will reject your SAAR_N if this section is left incomplete

PART IV – Completion by Authorized Staff Preparing Account Information 31- 33b.

IDES Account Management info and signatures

Please contact the help desk at 1-800-292-7178 for assistance.